Vulnerabilities for ujson

First version without a known vulnerability: 5.13.0

Details

• GHSA-3j69-69wj-xqx22026-06-19

  UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

  Fixed in: 5.13.0

• GHSA-c38f-wx89-p2xg2026-05-12

  UltraJSON has a Memory Leak in ujson.dump() on Write Failure

  Fixed in: 5.12.1

• GHSA-c8rr-9gxc-jprv2026-03-18

  UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

  Fixed in: 5.12.0

• GHSA-wgvc-ghv9-3pmm2026-03-18

  UltraJSON has a Memory Leak parsing large integers allows DoS

  Fixed in: 5.12.0

• GHSA-wpqr-jcpx-745r2022-07-05

  Incorrect handling of invalid surrogate pair characters

  Fixed in: 5.4.0

• GHSA-fm67-cv37-96ff2022-07-05

  Potential double free of buffer during string decoding

  Fixed in: 5.4.0

• OSV-2021-18092022-02-25

  Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so

  Fixed in: f6860f1f3d8d4e92b9be0e5815355a8976c6e75b, 550ba4d77294e61597a5259d00769c61281e0042

• GHSA-fh56-85cw-5pq62022-01-21

  UltraJSON vulnerable to Out-of-bounds Write

  Fixed in: 5.2.0, 5.1.0

• OSV-2021-9552021-07-11

  Stack-buffer-overflow in Buffer_AppendIndentUnchecked

  Fixed in: f6860f1f3d8d4e92b9be0e5815355a8976c6e75b, 5525f8c9ef8bb879dadd0eb942d524827d1b0362